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Amendments To The Specification: 

In the English translation document, please delete the temi ~Description~at page 1 line 

1, before the title. 

hi the English translation document, please add the paragraph at page 1 line 4, after the 
title, as follows: 

"CROSS REFERENCE TO RELATED APPLICATIONS 

This application is the US National Stage of International Application No. 
PCT/EP03/05806, filed June 3, 2003 and claims the benefit thereof. The International 
Application claims the benefits of European application No. 02012473.1 filed June 11, 2002, 
both applications are incorporated by reference herein in their entirety.- 

In the English translation document, please add the paragraph at page 1 line 4, after the 
newly added CROSS REFERENCE TO RELATED APPLICATIONS section, as follows: 
"FIELD OF INVENTION 

The invention relates to a method and an access multiplexer for quick access to data networks.— 

In the English translation document, please add the section heading at page 1 line 4, after 
the newly added FIELD OF INVENTION paragraph, as follows: 
-BACKGROUND OF INVENTION- 

In the English translation document, please add the paragraphs at page 2 line 4, as 
follows: 

In order to avoid this disadvantage, "DSL: The Corporate Connection", T. Jessup, Data 
Communications Vol. 27, No. 2 (February 1998), pp. 103-108, McGraw Hill, New York, 
proposes for example that the DSL access lines be connected xising ATM networks, Ethernets, 
Tl connections, serial lines or frame relays. 

If the subscriber-side termination of the connection is implemented cost-effectively using 
Ethernet, there is however a danger that as a result of the self-configuration capabilities of the 
Ethernet bridge EB required in conjunction with the access multiplexer DSLAM an attack on the 
DSLAM using a large number of falsified MAC addresses (MAC = media access control) causes 
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the routing tables of the DSLAM to overflow. In addition, in the case of unfiltered Ethernet 
trafiBc, unauthorized connections between the data terminal devices Dl, D2, D3 are possible, for 
example. 

In the English translation dociiment, please add the section heading at page 2 line 4, after 
the newly added paragraphs, as follows: 
"SUMMARY OF INVENTION- 

In the English translation document, please amend the paragraph at page 2 lines 5-7, as 
follows: 

The object of the present invention is therefore to specif / a method and an access multiplexer for 
quick access to data networks, by means of which attacks on a DSLAM are prevented and 
unauthorized direct connections between data terminal devices connected to the DSLAM are 
prevented to set down a method and an access multiplexer for quick access to data networks, by 
means of which the disadvantages of the prior art arc avoided . 

In the English translation document, please amend the paragraph at page 2 lines 9-13, as 
follows: 

This object is achieved by the claims a method for quick access to data networks on the 
basis of the preamble of Claim 1 through its characterizing features, and by an access multiplexer 
for quick access to data networks on the basis of the preamble of Claim 7 through its 
characterizing features . 

In the English translation document, please amend the paragraph at page 2 lines 17-30, as 
follows: 

According to the present invention, a method for quick access to data networks INT is provided 
in which data terminal devices Dl, D2, D3 of subscribers are each connected by means of a 
modem Ml, M2, M3 respectively by way of a digital subscriber line DSLl, DSL2, DSL3 
respectively to an access multiplexer DSLAM, whereby for the purposes of data transfer between 
the data terminal devices Dl, D2, D3 and an access server B-RAS which is located downstream 
of the access multiplexer (DSLAM), which serves to check the access authorization of the data 
terminal devices Dl, D2, D3 and establish the access to the data network (INT), the Point-to- 
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Point Protocol over Ethernet PPPoE is xised, according to which the link from the access 
multiplexer DSLAM to the access server B-RAS and to further components located downstream 
is implemented by means of an Ethernet network ETH. In this situation the access multiplexer 
has an Ethemet bridge (EB) which has filtering facilities for evaluating the PPPoE headers 
contained in received Ethernet frames, whereby: 

z Ethemet frames are routed to the Ethemet bridge (EB) if the PPPoE header can be 

assigned to an existing connection confirmed by the access server, or if the PPPoE header can be 
assigned to connection which is set up, and 

:; all other Ethemet frames which contain a PPPoE header are discarded, and 

z all Ethemet frames which do not contain a PPPoE header are discarded. 

In other words, all those Ethemet frames are discarded which can not be assigned to an existing 
PPPoE connection or to a PPPoE connection which is set up. 

In the English translation document, please amend the paragraph at page 2 line 32 to page 
3 line 4, as follows: 

In accordance with the present invention, for quick access to data networks INT an access 
multiplexer DSLAM is additionally provided, to which data terminal devices Dl, D2, D3 of 
subscribers are each connected by means of a modem Ml, M2, M3 respectively by way of a 
digital subscriber line DSLl, DSL2, DSL3 respectively, whereby for the purposes of data 
transfer between the data terminal devices Dl, D2, D3 and an access server B-RAS, which 
serves to check the access authorization of the data terminal devices Dl, D2, D3 and establish 
the access to the data network (INT), the Point-to-Point Protocol over Ethemet PPPoE is used, 
whereby the access multiplexer DSLAM is connected to the access server (B-RAS) and to 
fiirther components located downstream by means of an Ethemet network (ETH) and whereby 
the access multiplexer has the aforementioned Ethemet bridge and filtering facilities . 

In the English translation document, please amend the paragraph at page 3 lines 6-14, as 
follows: 

An important advantage of the method according to the invention and of the access multiplexer 
DSLAM according to the invention consists in the fact that it is considerably more cost-effective 
to set up an Ethemet network than to set up an ATM network since Ethemet components are 
simpler and thus cheaper to manufacture. Maintenance and operation of an Ethemet network are 
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likewise significantly more cost-effective since an Ethernet network is self-configuring and the 
network administration required in the case of ATM networks is thus dispensed with. In this 
situation, the invention prevents attacks from being carried out on a DSLAM. using falsified 
MAC addresses for example, and prevents the possibility of imauthorized direct connections 
being set up between data terminal devices connected to the DSLAM. 

In the EngHsh translation document, please amend the paragraph at page 3 lines 16-27, as 
follows: 

If the subscriber-side termination of the connection is implemented cost-effectively using 
Ethernet, there is a danger that as a result of the self-configuration capabilities of the Ethernet 
bridge EB required in conjxmction with the access multiplexer DSLAM an attack on the DSLAM 
using a large nximber of falsified MAC addresses (MAC = media access control) causes the 
routing tables of the DSLAM to overflow. In addition, in the case of unfiltered Ethernet traffic, 
unauthorized connections between the data terminal devices Dl, D2, D3 are possible, for 
example. To the best advantage, all Ethernet frames which can not be assigned to an existing 
PPPoE connection or to a PPPoE connection which is set up are therefore discarded ■ Claims 2 

In the English translation document, please amend the paragraph at page 3 line 33 to page 
4 line 5, as follows: 

In one development of the method according to the invention and of the access multiplexer 
according to the invention, a combination with a method and/or with means offering overload 
protection is provided Claims 3 to 5 and 9 to 1 L The advantage of this combination consists in 
the fact that strong pulses or bursts of data traffic on the high bit rate Ethemet interface, which 
are to be routed to only one of the digital subscriber lines - which are low bit rate when 
compared with the Ethemet interface -, can not result in an overload situation there since 
Ethemet frames are necessarily already discarded from the receive buffer of the Ethemet 
interface. Ethemet frames which are used for cotmection control are advantageously excluded 
from the discard strategy. 
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In the English translation document, please add the section heading at page 4 line 9, as 
follows: 

-BRIEF DESCRIPTION OF THE DRAWING- 

In the English translation document, please add the section heading at page 4 line 12, as 
follows: 

-DETAILED DESCRIPTION OF INVENTION- 
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METHOD AND ACCESS MOLTZPLEXER FOR QUICK ACCESS TO DATA NETWORKS 



[0001] This application is the US National Stage of International 
Application No. PCT/EP03/05806, filed June 3, 2003 and claims the 
benefit thereof. The International Application claims the 
benefits of European application No. 02012473.1 filed June 11, 
2002, both applications are incorporated by reference herein in 
their entirety. 

FIELD OF INVENTION 
[0002] The invention relates to a method and an access multiplexer 
for quick access to data networks. 



particular asymmetric DSL methods (ADSL = asymmetric digital 
subscriber line) are increasingly used for quick access to the 
Internet. In this situation, ADSL differs from symmetric DSL 
methods (SDSL = symmetric digital subscriber line) essentially in 
that in the case of ADSL different transfer rates are provided for 
uplink (transfer from subscriber to the internet) and downlink 
(transfer from the internet to the subscriber) . In this situation, 
the downlink transfer rate is regularly significantly (by a factor 
of 4 or 6, for example) higher than the uplink transfer rate since 
typically more data is transferred per unit of time over the 
downlink than over the uplink. In the case of SDSL, on the other 
hand, the transfer rates for downlink and uplink are the same. 

[0004] In the following the term "DSL" is used as a generic term 
both for "ADSL" and also for "SDSL" since the actual transfer 
rates and the ratio of the transfer rates between uplink and 
downlink are of no relevance to the present invention. 

[0005] A data terminal device of the subscriber, for example a PC 
(PC= personal computer) or a set-top box, is connected via a 
conventional copper twin wire to an access multiplexer (DSLAM) by 



CROSS REFERENCE TO RELATED APPLICATIONS 



BACKGROUND OF INVENTION 



[0003] DSL methods (DSL = digital subscriber line) and in 
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means of an integrated or external modem to a DSLAM (DSL»AM = DSL 
access multiplexer) . The DSLAM is located in an access node of the 
network provider, which provides the connection for the 
subscriber. Typically, a plurality of subscribers is connected via 
corresponding interface modules of a DSLAM to the DSLAM. 

[0006] In conventional DSL access networks, the DSLAM is linked to 
downstream network elements by means of an ATM network (ATM = 
asynchronous transfer mode) . 

[0007] The disadvantage in this situation is the fact that ATM 
networks are expensive and complicated both in their construction 
and in their operation since on the one hand the components of an 
ATM network (switches for example) are expensive in comparison 
with components which support other transfer technologies and on 
the other hand each connection in an ATM network needs to 
administered separately. 

[0008] In order to avoid this disadvantage, "DSL: The Corporate 
Connection", T. Jessup, Data Communications Vol. 27, No. 2 
(February 1998), pp. 103-108, McGraw Hill, New York, proposes for 
example that the DSL access lines be connected using ATM networks, 
Ethernets, Tl connections, serial lines or frame relays. 

[0009] If the subscriber-side termination of the connection is 
implemented cost-effectively using Ethernet, there is however a 
danger that as a result of the self-configuration capabilities of 
the Ethernet bridge EB required in conjunction with the access 
multiplexer DSLAM an attack on the DSLAM using a large number of 
falsified MAC addresses (MAC = media access control) causes the 
routing tables of the DSLAM to overflow. In "addition, in the case 
of unfiltered Ethernet traffic, unauthorized connections between 
the data terminal devices Dl, P2, D3 are possible, for example. 

SUMMARY OF INVENTION 
[0010] The object of the present invention is therefore to specify 
a- method and an access multiplexer for quick access to data" 
networks, by means of which attacks on a DSLAM are prevented and 
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unauthorized direct connections between data terminal devices 
connected to the DSLAM are prevented. 

[0011] This object is achieved by the claims. 

[0012] Preferred embodiments are set down in the dependent claims. 

[0013] According to the present invention, a method for quick 
access to data networks INT is provided in which data terminal 
devices Dl, D2, D3 of subscribers are each connected by means of a 
modem Ml, M2, M3 respectively by way of a digital subscriber line 
DSLl, DSL2, DSL3 respectively to an access multiplexer DSLAM, 
whereby for the purposes of data transfer between the data 
terminal devices Dl, D2, D3 and an access server B-RAS which is 
located downstream of the access multiplexer (DSLAM) , which serves 
to check the access authorization of the data terminal devices Dl, 
D2, D3 and establish the access to the data network (INT), the 
Point-to-Point Protocol over Ethernet PPPoE is used, according to 
which the link from the access multiplexer DSLAM to the access 
server B-RAS and to further components located downstream is 
implemented by means of an Ethernet network ETH. In this situation 
the access multiplexer has an Ethernet bridge (EB) which has 
filtering facilities for evaluating the PPPoE headers contained in 
received Ethernet frames, whereby: 

- Ethernet frames are routed to the Ethernet bridge (EB) if the 
PPPoE header can be assigned to an existing connection confirmed 
by the access server, or if the PPPoE header can be assigned to 
connection which is set up, and 

- all other Ethernet frames which contain a PPPoE header are 
discarded, and 

- all Ethernet frames which do not contain a PPPoE header are 
discarded. 

In other words, all those Ethernet frames are discarded which can 
not be assigned to an existing PPPoE connection or to a PPPoE 
connection which is set up. 

[0014] In accordance with the present invention, for quick access 
to data networks INT an access multiplexer DSLAM is additionally 
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provided, to which data terminal devices Dl, D2, D3 of subscribers 
are each connected by means of a modem Ml, M2, M3 respectively by 
way of a digital subscriber line DSLl, DSL2, DSL3 respectively, 
whereby for the purposes of data transfer between the data 
terminal devices Dl, D2, D3 and an access server B-RAS, which 
serves to check the access authorization of the data terminal 
devices Dl, D2, D3 and establish the access to the data network 
(INT), the Point-to-Point Protocol over Ethernet PPPoE is used, 
whereby the access multiplexer DSLAM is connected to the access 
server (B-RAS) and to further components located downstream by 
means of an Ethernet network (ETH) and whereby the access 
multiplexer has the aforementioned Ethernet bridge and filtering 
facilities . 

[0015] An important advantage of the method according to the 
invention and of the access multiplexer DSLAM according to the 
invention consists in the fact that it is considerably more cost- 
effective to set up an Ethernet network than to set up an ATM 
network since Ethernet components are simpler and thus cheaper to 
manufacture. Maintenance and operation of an Ethernet network are 
likewise significantly more cost-effective since an Ethernet 
network is self-configuring and the network administration 
required in the case of ATM networks is thus dispensed with. In 
this situation, the invention prevents attacks from being carried 
out on a DSLAM, using falsified MAC addresses for example, and 
prevents the possibility of unauthorized direct connections being 
set up between data terminal devices connected to the DSLAM, 

[0016] If the subscriber-side termination of the connection is 
implemented cost-effectively using Ethernet, there is a danger 
that as a result of the self -configuration capabilities of the 
Ethernet bridge EE required in conjunction with the access 
multiplexer DSLAM an attack on the DSLAM using a large number of 
falsified MAC addresses (MAC = media access control) causes the 
routing tables of the DSLAM to overflow. In addition, in the case 
of unfiltered Ethernet traffic, unauthorized connections between 
the data terminal devices Dl, D2, D3 are possible, for example. To 
the best advantage, all Ethernet frgimes which can not be assigned 
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to an existing PPPoE connection or to a PPPoE connection which is 
set up are therefore discarded. 

[0017] To the best advantage, when using the invention the 
conventional link between the data terminal devices of the 
subscribers and the access multiplexer is retained. 

[0018] In one development of the method according to the invent^ion 
and of the access multiplexer according to the invention, a 
combination with a method and/or with means offering overload 
protection is provided. The advantage of this combination consists 
in the fact that strong pulses or bursts of data traffic on the 
high bit rate Ethernet interface, which are to be routed to only 
one of the digital subscriber lines - which are low bit rate when 
compared with the Ethernet interface can not result in an 
overload situation there since Ethernet frames are necessarily 
already discarded from the receive buffer of the Ethernet 
interface. Ethernet frames which are used for connection control 
are advantageously excluded from the discard strategy. 

[0019] The method according to the invention will be described in 
detail in the following as an embodiment with reference to a 
drawing . 

BRIEF DESCRIPTION OF THE DRAWING , 
[0020] The single Figure 1 shows a schematic view of the network 
structure for quick access to a data network using a digital 
subscriber line. 

DETAILED DESCRIPTION OF INVENTION 
[0021] Figure 1 shows three data terminal devices Dl, D2, D3 which 
are each connected by means of a modem Ml, M2, M3 respectively by 
way of a digital subscriber line DSLl, DSL2, DSL3 respectively to 
an access multiplexer DSLAM. Typically, conventional (copper) 
telephone lines are used for quidk access to the Internet INT 
using a digital subscriber line DSL, over which conventional 
analog or digital telephony services can be handled 
simultaneously. On the subscriber side this requires a splitter or 
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filter Fl, F2, F3 in each case for connecting each telephony 
terminal device Tl, T2, T3 . Although a coupling of the digital 
subscriber line DSL with conventional telephony services is 
normal, the present invention can also be used for DSL methods 
which do not provide this coupling. 

[0022] The access multiplexer DSLAM separates telephony and data 
services and routes the telephony services for example over a 
conventional switching center TDM-Vst (TDM = time division 
multiplex) into the public telephone network PSTN (PSTN = public 
switched telephony network) . According to the invention, the data 
services are routed by way of an Ethernet network ETH to an access 
server B-RAS (B-RAS = broadband remote access server) and thence 
onto the Internet INT. 

[0023] For the purposes of data exchange between the access server 
B-RAS and one of the data terminal devices Dl, D2 , D3 the PPPoE 
protocol (PPPoE = Point- to-Point Protocol over Ethernet) is used 
which transports PPP data (PPP = Point- to-Point Protocol) , which 
in turn conveys IP data (IP = Internet Protocol) . 

[0024] The PPPoE data is transferred between data terminal device D 
and modem M using Ethernet in the majority of cases. Other 
transfer methods between data terminal device D and modem M are 
for. example ATM or the USB protocol (USB = Universal Serial Bus) . 
The transfer between modem M and access multiplexer DSLAM takes 
place by means of ATM. 

[0025] Since according to the invention the onward transportation 
does not take place - as has previously been customary - using ATM 
but by way of Ethernet, the PPPoE data is recovered in the access 
multiplexer and encapsulated in Ethernet frames for transfer over 
the Ethernet network ETH, in other words the already existing 
Ethernet header is supplemented with a checksum and an initial 
identifier. 

[0026] For this purpose the access multiplexer DSLAM has an 
Ethernet bridge EB which has filtering facilities to afford 
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protection against denial-of-service attacks and unauthorized 
access. If the subscriber-side termination of the connection is 
implemented cost-effectively using Ethernet, there is a danger 
that as a result of the self -conf iguration capabilities of the 
Ethernet bridge EB an attack on the DSLAM using a large number of 
falsified MAC addresses will cause the routing tables of the DSLAM 
to overflow. In addition, in the case of unfiltered Ethernet 
traffic, unauthorized connections between the data terminal 
devices Dl, D2, D3 are possible, for example. In this situation, 
the following filter rules are applied: 

- Ethernet frames are routed to the Ethernet bridge (EB) if the 
PPPoE header can be assigned to an existing connection 
confirmed by the access server (B-RAS) , or if the PPPoE header 
can be assigned to connection which is set up, whereby a timer 
is started when the connection is set up and when the timer 
times out the MAC address of the sending Ethernet component is 
removed from the routing tables of the Ethernet bridge (EB) 
provided that no confirmation of the connection set-up is given 
by the access server (B-RAS) before the timer times out, and 

- all other Ethernet frames which contain a PPPoE header are 
discarded, and 

- all Ethernet frames which do not contain a PPPoE header are 
discarded. 

[0027] As a result of this filtering, the aforementioned attacks or 
unauthorized access attempts are effectively suppressed. 

[0028] As a result of the different transfer rates of the 
subscriber-side interfaces DSLl, DSL2, DSL3 (currently a maximum 8 
MBit/s, normally for example 1.5 MBit/s or 768 kBit/s or 512 
kBit/s) and of the network-side Ethernet interface or Ethernet 
interfaces (currently a maximum 1 GBit/s, normally for example 100 
MBit/s) of the access multiplexer DSLAM, situations can arise in 
the transfer direction toward the data terminal device D of a 
subscriber in which data is delivered over the Ethernet 
interface (s) at the maximum transfer rate (for example 100 MBit/s) 
for a single digital subscriber line DSL, over which the onward 
transportation of the data is only possible at a considerably 
lower transfer rate (for example 768 kBit/s). As a result of the 
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transfer method based on ATM, on the digital subscriber line DSL 
this can result in the user data traffic between access 
multiplexer DSLAM and data terminal device D coming to a complete 
stcuidstill in spite of a transfer path operating under full load 
between access multiplexer DSLAM sind modem M. 

[0029] This is caused by the fact that data in the form of Ethernet 
frames or PPPoE frames is delivered from a receive buffer of the 
Ethernet interface (s) of the DSLAM at a high data rate, or 
transfer rate, to a send buffer of the ATM interface of the 
digital subscriber line DSL. Since Ethernet frames or PPPoE frames 
are typically considerably larger than ATM cells, a distribution 
of the frames over a plurality of ATM cells, each capable of 
conveying 48 bytes of used data, is required. This operation is 
known as segmentation. As a result of discard strategies in the 
send buffer of the ATM interface, the situation can now occur in 
which one or more of these ATM cells are discarded from each frame 
to be transferred, which results in the frames being transferred 
incompletely, discarded at the destination and begin requested 
again. 

[0030] In order to avoid a blocking of this type, in an 
advantageous development of the invention a mechanism is provided 
which uses a Random Early Discard (RED) strategy that is actually 
applied in the receive buffer of the Ethernet interface to 
reliably avoid overload situations before they actually arise. 
Discard strategies other than RED can likewise be applied, for 
example a discard based on frame size or priority information. 

[0031] In order to control the discard of frames in the receive 
buffer of the Ethernet interface, the status of the send buffers 
of the ATM interfaces of the digital subscriber lines DSLl, DSL2, 
DSL3 is monitored by means of an appropriate logic circuit. As 
soon as this determines that the number of frames incoming per 
unit time by way of the receive buffer exceeds the number of 
frames outbound from there per unit time by a value to be 
specified according to the buffer sizes for one of the send 
buffers of the ATM interfaces, Ethernet frames which are to be 
conveyed to that particular send buffer will be discarded from the 
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receive buffer of the Ethernet interface. To this end, it is 
necessary for a determination to actually be carried out in the 
receive buffer of the Ethernet interface as to where incoming 
frames are to be conveyed to, in other words an initial evaluation 
of the destination address should already be performed before the 
actual routing of a frame. 

[0032] If the number of frames outbound from the send buffer per 
unit time lies, for example as a result of major transfer 
disruptions on the digital subscriber line, below an initial 
threshold value which is to be defined, all incoming frames for 

this send buffer will be discarded. If the number of frames 
outbound from the send buffer per unit time lies above the first 
but below a second threshold value which is to be defined, frames 
are discarded according to the selected discard strategy either 
randomly or in accordance with criteria which are to be defined . 
Priority information relating to the conveyed frames or the frame 
length, for example, can be considered as possible criteria. 
Further threshold values can be defined in order to enable a 
sufficiently fine level of adjustment of the discard strategry, for 
example in order to support a greater niomber of priority values. 
In the simplest case, the second threshold value actually 
corresponds to the maximum data rate of the digital subscriber 
line DSL, in other words if the number of incoming frames per unit 
time for a special digital subscriber line DSL in the DSLAM is 
greater than the number of frames outbound with the maximum data 
rate of the digital subscriber line DSL, frames will be discarded 
in accordance with the selected discard strategy. 

[0033] The discard of Ethernet frames is non-critical for the 
transfer of data insofar as higher protocol layers, for example 
the Transmission Control Protocol TCP, monitor the transfer and 
initiate the renewed transfer of lost information. 

[0034] According to a development of the invention, frames which 
are used for connection control purposes are not discarded. 
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[0035] Although the invention has been described with reference to 
a DSL access multiplexer DSLAM, the method according to the 
invention and the access multiplexer according to the invention 
can also be applied to other methods for quick access to data 
networks in which the access multiplexer is linked to downstream 
components by means of a cost-effective Ethernet network. 
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